When we leave our homes and cars, we lock the doors. Interactive doorbells and cameras alert us to motion on our properties. Subscription services allow for monitoring and recording of front porches and backyards. If such measures aren’t in place, we risk physical and emotional loss. 

Is protecting your business different? The cost of a security breach isn’t just financial. It can impact your reputation, your recovery, and the overall morale of your company. Continuity and protection go beyond the role of one single department. Attention to cybersecurity and operational resilience is imperative from an overall business perspective.    

The Dangers Lurk

Before looking into the actual cost of a security breach, it is important to understand some of the main sources of today’s security attacks. Humans rank as the primary blame, having caused an alarming 95% of cybersecurity issues in 2022. Whether through phishing, smishing, trusted third party access, or an employee mistakenly welcoming a cyber-criminal through a familiar-looking email, simple, innocent actions can create chaos in a split second.    

Simple ways that breaches happen include:  

• Weak or stolen end-user information such as reused or simple passwords   
• Sharing credentials with multiple employees or third party vendors 
• Permissions inappropriately assigned and managed  
• Unsuitable configurations in place 
• Undetected vulnerabilities, often due to a lack of proper change management, CMDB registry, and patch management processes  

The 2023 statistics on the current, most targeted areas of cyber-attacks include:    

1. Artificial Intelligence. The use of Wi-Fi and Bluetooth enables the operation of everything from a doorbell to a furnace and is rapidly being integrated in vehicles. Automatic features involving machine learning such as cruise control systems and stereos are creating portals through which hacking and security threats can occur, even to the point of being able to listen in on people’s conversations as they drive.  
2. Emails and Texts. On average, a phishing attack hits an inbox every 39 seconds, growing the list of victims daily. In fact, the number of victims increased in 2022 by 34% from 2021. The Anti-Phishing Working Group (APWG) recorded the worst numbers in history in 2022, with the first quarter totals exceeding one million - the most attacks ever observed within such a time period.  
3. eCommerce. This sector has two disadvantages. Cybercrime is alive and well and lurking in the websites shopped each day. Attackers only need the first six numbers of a credit card to enlist software that can generate the remaining digits, and they are eager to use eCommerce sites to test their accuracy. Also, there is no guarantee that such sites enlist the necessary tactics to thwart the influx of fraud. Shoppers are naïve to the protective measures (or lack thereof) taken by the sites they visit. 
4. Crime-as-a-service (CaaS). Cybercrime has become a revenue-generating business, with hackers offering their services to interested participants. Toolkits and ‘package deals’ are provided, arming others with the ability to invade and steal. Intricate codes and special skills are a thing of the past and the ability to hack is becoming somewhat of a mainstream, managed service. 
5. Cloud Storage. Considering the volume of information stored in the cloud, and the fact that clouds house data from across the globe, an attacker needs only to gain access to a fragment to cause major damage. Partial breaches quickly grow into major problems. Cloud providers must implore meticulous measures of protection in housing such large amounts of vital information. Still touted as a safer measure than onsite storage, it is imperative to partner with a quality, certified provider.

More Than a Price to Pay

Market insight guru Statista reports that, although there were 60 fewer cases of data compromise in 2022, there was an increase of 120 million more people who were impacted. Among the most targeted and hardest hit industries were Healthcare, Financial Services, and Manufacturing. As to the source of the crimes, each of these three sectors fell victim to a threat actor posing as an authorized user.  

Just looking at the impact of security breaches from a numbers angle, however, gives an incomplete report card. Data breaches reach much further and impact more than a compilation of yearly stats. For example: 

1. The overall recuperation and recovery effort needed after a breach is tremendous and extends both internally and externally. Having to rebuild the company brand requires an increase in marketing initiatives. Clients and customers need to be reassured that they can trust the business they are working with.  
2. The risk of others gaining proprietary information has competitors actively mining data at the first word of a breach. Blueprints, strategies, recipes, and other specifics have the potential of landing at the fingertips of criminals and competitors particularly during a time of weakness.  
3. While an attack is underway, a threat actor has the ability to insert changes on your website or other systems that go undetected and thus continue to harm or impact your business.   
4. Legal fees come into play when your company fails to properly protect and mitigate security risks. The potential price tag on this misstep averages $90,000 but can reach into millions of dollars.  
5. Some employees may feel vulnerable and less than empowered when others are actively involved and paid overtime to remedy the issue. Will employees stick around? What will they tell peers and business partners about the breach – and how quickly will that news spread?  
6. Implementing proper security measures following a breach is unavoidable. It protects the future of a business while helping to restore its reputation. Doing so reactively versus proactively is an expensive approach.  

Questions to Ponder

Having a company that is motivated in the world of cybersecurity is key. The price of a breach – monetary and beyond, far outweighs the cost of having a defense plan in place from the start. Research has proven that cyberattacks particularly target companies that are weak in their operational resilience programs.   

Your cyber and operational resilience plans need to have answers to security questions including:  

• What back-up processes are in place to assure multi-instance and validated data integrity?  
• How are your files secured locally, remotely, and offline?  
• How do you manage employees utilizing personal devices for work activities?  
• What are the regulatory obligations regarding compliance of sensitive information?  
• How are administrative rights and permissions for your systems managed?

Your business has options to assist with developing its cybersecurity and operational resilience program. These options include hiring skilled staff, utilizing software, or hiring outside consultants. It is likely that you will use a mixed course of action to fit your business needs and resources.  

Enlisting a partner in this equation may prove to be a beneficial investment. Cyber partners can support and bolster existing practices, assist with due diligence, and bring experience to quickly mature the present systems and practices in place, helping mitigate business risk while providing metrics, benchmarking, and project prioritization.  

Diligence Matters

Thirty percent of cyber experts feel their organizations are lacking in cybersecurity presence. In a world where simply opening an attachment could mean disaster, businesses must be diligent. Given the risks and impacts of a cybersecurity breach, the true cost of a poorly laid plan goes beyond dollars and cents. Operational efficiency and resilience require a full-court press approach, rather than resting the responsibility on the shoulders of one single department.  

Security and resilience involve the business at each level. Recovery impacts brand reputation, customer and employee satisfaction, competitor dangers, legal and regulatory fees, and carries the possibility of permanent closure. With today’s many options, resources, and supporting data, companies have solid solutions to pursue for mitigation against cyber and resilience threats.    

The Cayuse cybersecurity team stands at-the-ready to guide your business in the safest way possible. Whether to gain traction on a defense plan already in place, or enlist the help of experts to generate a new one, cybercrimes involve strategy that requires knowledge and skill to finesse. Make sure that you are doing what your business requires, to safeguard your people, processes, and system from invasion. 

Editor's note: This post was originally published in 6/2022 and has been updated for freshness, accuracy, and comprehensiveness.